A team wants cloning permissions without unrelated database-management rights. Which approach should be evaluated?

1. Make the source database public
2. Assume cloning always requires full tenancy administrator rights
3. IAM policies constrained to the required clone operations and supported clone-type conditions
4. Give users the source schema's ADMIN password only